Methods and systems for managing networked storage system resources

ABSTRACT

Methods and systems for a networked storage environment are provided. One method includes mirroring a plurality of requests from a switch and transmitting the mirrored plurality of requests to a remote acquisition unit; extracting application layer protocol data units from assembled transport layer packets; parsing the application layer protocol data units to obtain file system requests; identifying storage volume identifiers from the parsed file system requests that are associated with a greatest number of operations; identifying network addresses for client systems initiating the greatest number of operations for the storage volumes and network addresses of target storage systems managing the storage volumes; and providing a total number of operations for the plurality of requests in a given time, the identified storage volume identifiers, the network addresses of the client systems and the network addresses of the target storage systems to a management console.

TECHNICAL FIELD

The present disclosure relates to networked storage environments andmore particularly, to innovative computing technology for monitoring andmanaging various resources that are used by the networked storageenvironments for storing and retrieving electronic data.

BACKGROUND

Various forms of storage systems are used today. These forms includedirect attached storage (DAS) network attached storage (NAS) systems,storage area networks (SANs), and others. Networked storage systems arecommonly used for a variety of purposes, such as providing multipleusers with access to shared data, backing up data, and others. Anetworked storage system typically includes at least one computingdevice executing a storage operating system for storing and retrievingdata on behalf of one or more client computing systems (“clients”). Thestorage operating system stores and manages shared data containers in aset of mass storage devices.

Networked storage systems are used extensively in NAS, SAN, cloud based,and virtual storage environments. The infrastructure uses variousphysical and virtual components, for example, servers, switches, hostbus adapters, network interface cards, storage devices, volumes, virtualmachines, and others. The performance and usage of these resourcesimpacts the overall performance providing storage services to clients.

Prior to the described innovative technology below, computing serverstypically connect to networked storage using for example, the Ethernetprotocol. In some environments, numerous client systems (host computingsystems, virtual machines, and others) access storage via a volume, avirtual logical object described below in detail. A storage array istypically blind to the client systems that impact the performance of avolume. When a volume is over-impacted, it is difficult for a storageadministrator to identify the source of the performance loads.

One conventional solution to the foregoing challenge is to installagents at client machines to collect information regarding trafficgenerated by each client. This, however, is an inefficient solution,especially in an environment that may have thousands of client machines.Maintaining compatibility of software agents with various operatingsystems on deployed client machines and managing the upgrade of thoseagents across the client machines is complicated and, hence undesirable.Continuous efforts are being made to develop computing technology thatcan be deployed at data centers and networked storage environments toefficiently manage and monitor infrastructure resources.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing features and other features will now be described withreference to the drawings of the various aspects. In the drawings, thesame components have the same reference numerals. The illustratedaspects are intended to illustrate, but not to limit the presentdisclosure. The drawings include the following Figures:

FIG. 1A shows an example of a networked storage environment for thevarious aspects disclosed;

FIG. 1B shows an example of various layers for monitoring and managingresources in the networked storage environment;

FIG. 1C shows a block diagram of a remote access unit, according to oneaspect of the present disclosure;

FIG. 1D shows an example of a management system, according to one aspectof the present disclosure;

FIG. 1E shows an example of a plurality of infrastructure objects thatare monitored by the management system of FIG. 1D, according to oneaspect of the present disclosure;

FIG. 1F shows a format for managing performance data in a networkedstorage environment, according to one aspect of the present disclosure;

FIG. 1G shows an example of a hierarchy of resource objects monitoredaccording to one aspect of the present disclosure;

FIG. 1H shows an example of different counters that may be used tocollect resource performance data for different resource types,according to one aspect of the present disclosure;

FIG. 1I shows a process for evaluating network traffic by the remoteacquisition unit, according to one aspect of the present disclosure.

FIG. 1J shows a process for using network traffic for managing resourcesof the networked storage environment, according to one aspect of thepresent disclosure;

FIG. 2A shows an example of a clustered storage system, according to oneaspect of the present disclosure;

FIG. 2B shows an example of a storage system node, used according to oneaspect of the present disclosure;

FIG. 3 shows an example of a storage operating system, used according toone aspect of the present disclosure; and

FIG. 4 shows an example of a processing system, used according to oneaspect of the present disclosure.

DETAILED DESCRIPTION

As a preliminary note, the terms “component”, “module”, “system,” andthe like, as used herein, are intended to refer to a computer-relatedentity, either software-executing general purpose processor, hardware,firmware, and a combination thereof. For example, a component may be,but is not limited to being, a process running on a processor, aprocessor, an object, an executable, a thread of execution, a program,and/or a computer.

By way of illustration, both an application running on a server, and theserver, can be a component. One or more components may reside within aprocess and/or thread of execution, and a component may be localized onone computer and/or distributed between two or more computers. Also,these components can execute from various non-transitory computerreadable media having various data structures stored thereon. Thecomponents may communicate via local and/or remote processes such as inaccordance with a signal having one or more data packets (e.g., datafrom one component interacting with another component in a local system,distributed system, and/or across a network, such as the Internet, withother systems via the signal).

Computer executable components can be stored, for example, onnon-transitory, computer readable media including, but not limited to,an ASIC (application specific integrated circuit), CD (compact disc),DVD (digital video disk), ROM (read only memory), floppy disk, harddisk, EEPROM (electrically erasable programmable read only memory),memory stick or any other storage device type, in accordance with theclaimed subject matter.

In one aspect, the various aspects of the present disclosure improvecomputing technology for monitoring and managing complex data centersand data center resources. In one aspect, a remote acquisition unit(RAU) is provided with innovative computing components that areconfigured to receive mirrored network traffic at network switches thatare used by client computing devices to access networked storage via anetwork connection. The mirrored traffic has multiple protocol layersthat are parsed by RAU to determine over-impacted storage volumes,client network access addresses that send requests for the over-impactedstorage volumes, and the target storage volume network access addressesthat are used to access the storage devices.

The RAU provides this information to a management console that executesa storage monitoring layer, and a server monitoring layer, formonitoring storage and compute resources. The management console thenuses the information from RAU, and the storage monitoring layer, and theserver monitoring layer to provide useful and simplified performancedata to a user so that the user can take corrective action to relieveover-impacted volumes. Details regarding the innovative computingtechnology are now described in detail.

System 100: FIG. 1A shows an example of a networked storage operatingenvironment 100 (also referred to as system 100) having a plurality ofresources for storing and accessing data in a networked storage systemin one aspect of the present disclosure. As an example, system 100 mayinclude a plurality of computing systems 104A-104N (may also be referredto as host system 104, server system 104, or client system/device 104)that may access one or more storage systems 108 via a network switch 120(may also be referred to as switch 120) coupled to a network 153 such asa local area network (LAN), wide area network (WAN), the Internet, orothers. As an example, network switch 120 maybe an Ethernet switch, whenthe hosts 104 use Ethernet to send input/output (I/O) requests to accessstorage devices.

In one aspect, the network switch 120 may include a plurality of ports122A-122N, 124A-124B and a mirroring port 125, having logic andcircuitry for handling network packets. For example, port 122A iscoupled to host 104A, port 122B is coupled to server 104B and port 122Nis coupled to server 104N. It is noteworthy that although system 100shows only one switch 120, there may be more than one switch to accessstorage system 108. Ports 124A and 124B are coupled to network 153 tocommunicate with storage system 108 to access storage devices in astorage array described below in detail. Port 125 of switch 120 operatesas a mirror port to capture network traffic for all the other ports(i.e., 122A-N and 124A-B) and transmits the mirrored traffic to RAU 101that is described below in detail.

It is noteworthy that network switch 120 may have more or fewer portsthan the number of ports shown in FIG. 1A. Furthermore, system 100 mayalso use storage switches (e.g. Fibre Channel switches (not shown)) toaccess storage area network (SAN) based storage devices.

In one aspect, RAU 101 is also connected to a management switch 103 thatincludes a plurality of ports 107, 109 and 111A-111B. It is noteworthythat system 100 may include more than one management switch 103 and mayinclude more, or fewer, ports. Port 107 is coupled to a managementsystem 118 that is described below in detail with respect to FIG. 1D,while port 109 connects RAU 101 to the management switch 103. Port 111Ais connected to the storage systems 108 and port 111B is connected toone or more user consoles 102A-102N (referred to as users). Users'102A-102N may access server system 104 for storage related servicesprovided by storage system 108 and also use management system 118 forobtaining management related services described below in detail. It isnoteworthy that the management switch 103 may also be connected toserver 104 so that the management console can obtain information fromserver systems 104.

The term ports as used herein with respect to the management switch 103and the network switch 120 means an entity that includes logic andcircuitry (for a physical port) for receiving network packets andtransmitting network packets to their destination. The logic andcircuitry will depend on the protocol used by the switches, for example,Ethernet, Fibre Channel, InfiniBand and others. The examples below aredescribed with respect to Ethernet, however, the adaptive aspects of thepresent disclosure are not limited to Ethernet.

Server systems 104 may be computing devices configured to executeapplications 106 over a variety of operating systems, including theUNIX® and Microsoft Windows® operating systems. Applications 106 mayutilize data services of storage system 108 to access, store, and managedata in a set of storage devices 110 that are described below in detail.Application 106 may include an email exchange application, a databaseapplication, or any other type of application. In another aspect,application 106 may comprise a virtual machine also described below inmore detail.

Server systems 104 generally utilize file-based access protocols whenaccessing information (in the form of files and directories) over anetwork attached storage (NAS)-based network. Alternatively, serversystems 104 may use block-based access protocols, for example, the SmallComputer Systems Interface (SCSI) protocol encapsulated over TCP (iSCSI)and SCSI encapsulated over Fibre Channel (FCP) to access storage via aSAN.

Server 104A may also execute a virtual machine environment 105,according to one aspect. In the virtual machine environment 105 aphysical resource is time-shared among a plurality of independentlyoperating processor executable virtual machines (VMs). Each VM mayfunction as a self-contained platform, running its own operating system(OS) and computer executable application software. The computerexecutable instructions running in a VM may be collectively referred toherein as “guest software”. In addition, resources available within theVM may be referred to herein as “guest resources”.

The guest software expects to operate as if it were running on adedicated computer rather than in a VM. That is, the guest softwareexpects to control various events and have access to hardware resourceson a physical computing system (may also be referred to as a hostplatform) which may be referred to herein as “host hardware resources”.The host hardware resource may include one or more processors, resourcesresident on the processors (e.g., control registers, caches, andothers), memory (instructions residing in memory, e.g., descriptortables), and other resources (e.g., input/output devices, host attachedstorage, network attached storage, or other like storage) that reside ina physical machine or are coupled to the host platform.

The virtual execution environment 105 executes a plurality of VMs126A-126N. VMs 126A-126A execute a plurality of guest OS 128A-128N (mayalso be referred to as guest OS 128) that share hardware resources 134.As described above, hardware resources 134 may include CPU, memory, I/Odevices, storage, or any other hardware resource.

A virtual machine monitor (VMM) 130, for example, a processor executedhypervisor layer provided by VMWare Inc., Hyper-V layer provided byMicrosoft Corporation (without derogation of any third party trademarkrights) or any other layer type, presents and manages the plurality ofguest OS 128A-128N. VMM 130 may include or interface with avirtualization layer (VIL) 132 that provides one or more virtualizedhardware resource 134 to each guest OS. For example, VIL 132 presentsphysical storage at storage devices 110 as virtual storage (for example,as a virtual hard drive (VHD)) to VMs 126A-126N. The VMs use the VHDs tostore information at physical storage devices 110.

In one aspect, VMM 130 is executed by server system 104A with VMs126A-126N. In another aspect, VMM 130 may be executed by an independentstand-alone computing system, often referred to as a hypervisor server,or VMM server, and VMs 126A-126N are presented via another computingsystem. It is noteworthy that various vendors provide virtualizationenvironments, for example, VMware Inc., Microsoft Corporation (withoutderogation of any third party trademark rights), and others. The genericvirtualization environment described above with respect to FIG. 1A maybe customized depending on the virtual environment provider.

In one aspect, storage system 108 has access to a set of mass storagedevices 110 (may be referred to as storage devices 110) within a storagesubsystem 112. As an example, storage devices 110 may be a part of astorage array within the storage sub-system.

Storage devices 110 are used by storage system 108 for storinginformation. The storage devices 110 may include writable storage devicemedia such as magnetic disks, video tape, optical, DVD, magnetic tape,non-volatile memory devices for example, self-encrypting drives, flashmemory devices, and any other similar media adapted to storeinformation. The storage devices 110 may be organized as one or moregroups of Redundant Array of Independent (or Inexpensive) Disks (RAID).The aspects disclosed herein are not limited to any particular storagedevice or storage device configuration.

In one aspect, to facilitate access to storage devices 110, a storageoperating system of storage system 108 “virtualizes” the storage spaceprovided by storage devices 110. The storage system 108 can present orexport data stored at storage devices 110 to server systems 104 and VMM130 as a storage volume, or one, or more, qtree sub-volume units. Eachstorage volume may be configured to store data files (or data containersor data objects), scripts, word processing documents, executableprograms, and any other type of structured or unstructured data. Fromthe perspective of the VMs/server systems, each storage volume canappear to be a single disk drive. However, each storage volume canrepresent the storage space in one disk, an aggregate of some, or all,of the storage space in multiple disks, a RAID group, or any othersuitable set of storage space.

It is noteworthy that the term “disk” as used herein is intended to meanany storage device/capacity and not to limit the adaptive aspects to anyparticular type of storage device, for example, hard disks.

The storage system 108 may be used to store and manage information atstorage devices 110 based on a request generated by server system 104,management system 118, user 102 and/or a VM. The request may be based onfile-based access protocols, for example, the NFS (network file system)or the CIFS (Common Internet File System) protocol, over TCP/IP(Transmission Control Protocol/Internet Protocol). Alternatively, therequest may use block-based access protocols, for example, iSCSI(Internet over SCSI) or FCP (Fibre Channel Protocol). The variousexamples described below are based on NFS traffic but the adaptiveaspects of the innovative technology are not limited to NFS or anyspecific protocol.

As an example, in a typical mode of operation, server system 104 (or VMs126A-126N) transmit one or more input/output (I/O) commands, such as anNFS or CIFS request, via switch 120 to the storage system 108. Storagesystem 108 receives the request, issues one or more I/O commands tostorage devices 110 to read or write the data on behalf of the serversystem 104, and issues an NFS or CIFS response containing the requesteddata to the respective server system 104.

In one aspect, storage system 108 may have a distributed architecture,for example, a cluster based system that may include a separate networkmodule and storage module, described below in detail with respect toFIG. 2A. Briefly, the network module is used to communicate with hostplatform server system 104 and management system 118, while the storagemodule is used to communicate with the storage devices 110 that are apart of a storage sub-system.

Storage system 108 maintains various data structures for storinginformation related to storage devices 110. For example, storage system108 is aware of the identity and capabilities of storage device 110.Storage system 108 maintains the information regarding all the VMs andserver systems that use storage device 110. This information may be keptas unique identifiers.

Because storage system 108 services read and write requests, itmaintains information regarding the number of I/O operations that areprocessed within a time unit, for example, a second, referred to hereinas “IOPS” by the storage device and by each storage volume. Storagesystem 108 also maintains information on a rate at which information istransferred (also referred to as a throughput rate) from the storagedevices. The throughput rate is maintained for each storage volume ofthe storage devices.

Architecture 116: FIG. 1B shows a high-level architecture 116 used bythe computing technology of the present disclosure to monitor and manageresources within system 100, according to one aspect of the presentdisclosure. Architecture 116 shows an infrastructure stack 116A thatidentifies various categories of resources that are used within system100, namely a storage layer 116C, a network layer 116D, and a serverlayer 116E. The storage layer 116C includes storage devices, storagepools, storage volumes, and other storage entities. The network layer116D includes network switches, network interface cards (NICs), andother network resources. The server layer 116E includes computeresources of system 100, for example, servers 104, and others.

A monitoring stack 116B is used to monitor the infrastructure componentsusing a storage monitoring layer 116F, a network monitoring layer 116G,and a server monitoring layer 116H. RAU 101 executes the networkmonitoring layer 116G, while the management system 118 interfaces orexecutes the storage monitoring layer 116F, and the server monitoringlayer 116H, described below in detail. It is noteworthy that the storagemonitoring layer 116F, and the server monitoring layer 116H may beexecuted by more than one computing device in a distributed environment.

Based on the innovative resource monitoring and analysis, a reportinglayer 116I presents information to users such that users can optimizeresource usage within their operating environments and reducebottlenecks.

RAU 101: FIG. 1C shows a block diagram of RAU 101, according to oneaspect of the present disclosure. In one aspect, RAU 101 is aspecialized computing server that is configured to receive mirrorednetwork traffic (e.g. NFS traffic) from network switch 120 via port 125that is configured to operate as a mirror port. The mirror port 125mirrors all packets flowing through other switch ports that areconnected to network interface cards (NICs) (or network adapters) ofstorage systems 108 described below in detail.

The mirrored NFS traffic is designed to provide a list of networkaddresses used by servers 104 (for example, client IP addresses) tocommunicate with the storage systems 108, target IP addresses (i.e. theIP addresses of the storage system 108, also mentioned as NFS servers),target volume identifiers (for example, master data set identifiers(MSIDs) and/or file system identifiers (FSIDs)) and operation types (forexample, read or write operation). The mirrored NFS traffic is receivedby a network interface 101A at RAU 101 and buffered at a storagelocation (not shown) of the network interface 101A. The mirrored NFStraffic is then pre-processed/analyzed by a packet analysis service(PAS) 101G. PAS 101G may be implemented using hardware components,software components, or a combination thereof.

In one aspect, PAS 101G includes a packet reader 101B, a packetre-assembler 101C, a packet parser 101D and a packet analyzer 101Edescribed below in detail. It is noteworthy that the term packet as usedherein is intended to include one or more protocol data units (PDUs) andthat multiple network level packets may be necessarily combined to forma single higher level PDU. It is also noteworthy that although, forclarity, these various components of PAS 101G are shown separately, theymay be consolidated into a single module executed by hardware customizedfor executing the process blocks described below.

In one aspect, the NFS traffic includes multiple layers/packets, forexample, an Ethernet header, a TCP header and IP header. The NFS PDUsthemselves are encapsulated in remote procedure call (RPC) PDUs that areembedded in transport layer packets (for example, TCP packets) and hencecan span multiple frames. Furthermore, TCP traffic may include many RPCPDUs with a plurality of NFS operations as NFS PDUs. RPC is a standardprotocol that one program can use to request a service from a programlocated in another computer.

The mirrored NFS traffic is first read by the packet reader 101B fromthe network interface 101A and then provided to a packet re-assembler101C that maybe a TCP re-assembler. In one aspect, the packet reader101B may include or use an application programming interface (API) toretrieve data directly from NIC 101A buffers (not shown) without havingto go through an operating system stack (for example, a Linux kernelstack, when RAU 101 uses Linux as an operating system). This isefficient because OS resources are not used. The adaptive aspectsdescribed herein are not limited to using the API by the packet reader101B.

The packet re-assembler 101C assembles the various TCP packets in themirrored traffic. The packet parser 101D inspects the TCP packet streamand identifies the embedded RPC PDUs. The packet parser 101D thenlocates the NFS PDUs from the RPC PDUs. The packet parser 101D evaluatesthe data in the NFS PDU and provides that information to the packetanalyzer 101E.

In one aspect, the NFS protocol does not include a volume name in eachNFS PDU and instead provides a file handle in the NFS PDU. The filehandle encodes the destination volume/file location for a NFS operation.The packet parser 101D evaluates the file handle and obtains the encodedidentifier for an NFS volume. The packet parser 101D provides thesevolume identifiers to packet analyzer 101E with information regardingoperation type. As described below, these identifiers are then used bythe management system 118 to translate the NFS volume identifiers tocorresponding NFS volume names that are used by each NFS server (i.e.,storage system 108).

The packet parser 101D also obtains the client server IP address (i.e.,the source IP address), and the storage system IP address, from the IPheader in the mirrored traffic stream. This information is also providedto the packet analyzer 101E.

In one aspect, the packet analyzer 101E tracks NFS operations requestedby clients (identified by IP addresses) to NFS servers (i.e., storagesystems 108 IP addresses) along with NFS volume identifiers. The packetanalyzer 101E determines a subset of NFS volumes that handle the highest(or greatest) number of NFS operations (i.e., read and writeoperations). The packet analyzer 101E also creates a subset of clientidentifiers (IP addresses) that is ranked by their count of observedoperations. In one aspect, the packet analyzer 101E uses a probabilisticsketch count to keep track of the operations, instead of usingindividual counters for each NFS volume and client. This is lessresource intensive and hence more efficient.

The packet analyzer 101E provides a total number of NFS operations thatare observed for a certain duration, a list of most heavily targetedstorage system IP addresses, volume identifiers sorted by the observedNFS operations and a sub-list of NFS clients for each “hot” volumesorted by the observed NFS operations.

The packet analyzer 101E provides periodic reports to the managementsystem 118 via the management switch 103. It is noteworthy that trafficto the same storage volume may appear in multiple reports from the RAU101, traffic from one compute resource may also appear in multiplereports to the same or different storage volumes. Details of managementsystem 118 are provided below.

Management System 118: FIG. 1D shows a block diagram of managementsystem 118 having a plurality of modules, according to one aspect. It isnoteworthy that the various modules of the management system 118 may beimplemented in one computing system at a management server/console or ina distributed environment among multiple computing systems.

In one aspect, the management system 118 receives data/reports from RAU101 via the management switch 103, as described above. The managementsystem 118 evaluates the list of top volumes and clients and maps thevolumes and clients to resources that are identified by the managementsystem 118 executing the storage monitoring layer 116F and the servermonitoring layer 116H, as described below in detail. For example, themanagement system 118 uses compute resource IP addresses (e.g., IPaddresses used by servers 104) to identify compute resources, storage IPaddresses (i.e., target IP addresses) to identify the storage system 108and internal volume identifiers that identify volumes managed by thestorage system 108. Once these entities are identified, the managementsystem 118 creates a performance path object (may be referred to as aNAS performance path object (e.g., 199, FIG. 1H)) that maps a server toan internal volume with associated performance counters to track theperformance metrics of the internal volume as described below in detail.Thereafter, the results of the analysis performed by the managementsystem 118 are displayed in a user interface on a display device.

In one aspect, the management system 118 includes a graphical userinterface (GUI) module 136 to generate a GUI for use by a storageadministrator or a user using a user console 102. In another aspect,management system 118 may present a command line interface (CLI) to auser.

Management system 118 may also include a communication module 146 thatimplements one or more communication protocols (Ethernet, Fibre Channel,InfiniBand and others) and/or APIs to enable the various modules ofmanagement system 118 to communicate with the RAU 101, management switch103, storage system 108, VMs 126A-126N, server system 104, and clients102.

In one aspect, management system 118 also includes an acquisition module144 that obtains information regarding storage devices 110 from storagesystem 108 and other resources of system 100 as part of implementing thestorage monitoring layer 116F. Acquisition module 144 also obtainsinformation regarding servers 104, as described below as part ofimplementing the server monitoring layer 116H.

Acquisition module 144 may send a discovery request to obtainconfiguration and performance information. The format and structure ofthe discovery request depends on the protocol/standard used by theacquisition module 144 to communicate with the storage system 108. Theinformation may include an amount of data that is transferred to andfrom a storage device within a certain duration, a number of IOPS thatare serviced by a storage device, the identity of the server systems(also referred to as host systems) that use the storage devices,utilization of the storage devices, storage nodes, cache utilization ofthe storage nodes, cache hit ratio of the storage nodes, and otherinformation, jointly referred to as performance metrics.

Management system 118 also includes a processor executable configurationmodule 142 that stores configuration information for various resourcesused by system 100, for example, storage system nodes, storage devices,storage switches, and other resources. The configuration information maybe stored as a data structure 148, shown as resource configuration data148 and may be referred to as configuration data structure 148 or simplyas data structure 148. In one aspect, the management system 118 alsomaintains information regarding storage device 110 at the resourceconfiguration data structure 148 to store a name of a storage devicemanufacturer, a storage device identifier, a maximum number of IOPS thatthe device can handle, and a throughput rate that the storage device isable to support.

Resource configuration data 148 also identifies the storage system 108that manages a storage device, the storage volumes associated with thestorage device, and the identity of users (for example, server systems104) that access the storage volumes. This information may be obtainedfrom storage system 108.

Resource configuration data 148, may also identify the switch 120 usedby system 100, the various ports of switch 120 and the identity of thedevices/computing systems that are coupled to the switch 120.

Resource configuration data 148 may further identify the VMM 130, forexample, the hypervisor that presents and controls VMs 126A-126N; thevarious VMs and the resources that are used by the VMs at any giventime, for example, VHDs. This information may also be acquired byacquisition module 144 from VMM 130 and storage system 108.

Management system 118 includes a performance monitoring module (may bereferred to as performance module) 140 that receives performance dataregarding various resources of system 100. The performance data may becollected based on stored policies 154. The resource performance datamay be stored at a data structure 150. The performance data 150 shows ifa storage device is over utilized at a given time, the number of IOPSwithin certain duration, a throughput within the certain duration,available capacity at any given time and other information. Performancedata 150 may also include information regarding the performance of NodeCPUs and any other configured resource. Performance data 150 may alsoinclude information regarding the various VMs, identity of the virtualdisks used by the VMs, and other information that is described below inmore detail. It is noteworthy that performance data 150 may be stored aspart of the storage monitoring layer 116E and the server monitoringlayer 116H.

Management system 118 may also include other modules 138. The othermodules 138 are not described in detail because the details are notgermane to the inventive aspects.

FIG. 1E shows an example of how performance data is maintained andcollected for various resources in executing the storage monitoringlayer 116E, according to one aspect. As an example, there are may be twotypes of resources, a service center and a delay center resource. Theservice center is a resource category that can be represented by a queuewith a wait time and a service time (for example, a processor thatprocesses a request out of a queue). The delay center may be a logicalrepresentation for a control point where a request stalls waiting for acertain event to occur and hence the delay center represents the delayin request processing. The delay center may be represented by a queuethat does not include service time and instead only represents waittime. The distinction between the two resource types is that for aservice center, performance data may include a number of visits, waittime per visit and service time per visit. For the delay center, onlythe number of visits and the wait time per visit at the delay center.

In one aspect, a flow type i.e. a logical view of the resources is usedfor handling client requests. The flow types include two categories,latency and utilization. A latency flow type is used for analyzing howlong operations take at the service and delay centers. The latency flowtype is used to identify a workload whose latency has increased beyond acertain level. A typical latency flow may involve writing data to astorage device based on a client request and there is latency involvedin writing the data at the storage device. The utilization flow type isused to understand resource consumption of workloads and may be used toidentify resource contention.

Referring now to FIG. 1E, the various resources of system 100 mayberepresented logically as infrastructure objects 156A-156N (may also bereferred to as resource objects 156 or objects 156). Data associatedwith the resources is collected using various counters shown as158A-158N and 160A-160N and then stored at performance data structure150 (FIG. 1D).

FIG. 1F shows an example of how a policy may be associated with aninfrastructure object 156 for collecting performance data, according toone aspect of the present disclosure. Infrastructure object 156 may beassociated with one or more policies 162A-162N and a time window 170.Threshold values 172 are assigned to certain parameters for generatingalerts and severity 174 defines the importance of an alert, for example,an alert may be critical, or it may only be a warning. Based on thepolicy, counters 156A are used to collect the appropriate data for thetime window 170.

Object Hierarchy: FIG. 1G shows an example of a format 151 for trackinginformation/relationships regarding different resources that are usedwithin storage system 100 and a clustered storage system shown in FIG.2A and described below in detail. The format 151 is used forimplementing the storage monitoring layer 116E, according to one aspectof the present disclosure. Each resource is represented as an object andis identified by a unique identifier value (object ID). One or morecounters collect performance data associated with the resource,described above in detail.

Format 151 maybe a hierarchical mesh where various objects may haveparent-child, peer, and remote peer relationships, as described below.As an example, format 151 shows a cluster object 151A that may becategorized as a root object type for tracking storage cluster (202,FIG. 2A) level resources. The cluster object 151A is associated withvarious child objects, for example, a storage node object 152B thatidentifies a storage node within the cluster. The cluster object 151Astores information regarding the cluster, for example, the number ofnodes it may have, information identifying the nodes, and any otherinformation.

The storage node object 151B stores information regarding a node, forexample, a node identifier and performance data regarding the nodes, forexample, CPU utilization of the nodes, latency (i.e., delay) inprocessing I/O requests, the number of storage volumes the node ismanaging, cache utilization, cache hit ratio, and other information.

Each cluster node object 151B may be associated with other objects forexample, a storage pool 151E and a port object 151D that is a child of aswitch object 151C representing a storage switch (not shown) to accessstorage devices 110. The port object 151D is also associated with astorage device object 151G denoting that the port provides access to thestorage device.

The storage pool 151E object stores an identifier for identifying astorage pool that may have one or more aggregates associated with one ormore storage devices. The storage pool object 151E stores informationregarding storage utilization, latency in responding to I/O requests andother information by one or more storage pools.

The storage pool 151E is associated with an internal volume object 151Hthat is managed by the storage operating system. The internal volume isassociated with a qtree object 151I that in turn is associated with avolume (for example, a LUN) 151M that is presented to a host system or ashare (for example, a CIFS share) 151N. The volume 151M may beassociated with a data store 151L.

A host system object 151F is used to store information regarding a hostand a virtual machine 151J tracks performance/configuration informationregarding a virtual machine. The virtual disk object 151K is used totrack information regarding a virtual disk. The virtual disk object 151Kis also associated with the data store object 151L.

The various objects of FIG. 1G are shown as an example. Other objecttypes may be added based on an operating environment. The performancedata and the configuration data including the relationship informationbetween the resources is stored at a storage device, as described belowin detail.

FIG. 1H shows an example of various objects for both the storagemonitoring layer 116F and the server monitoring layer 116H, according toone aspect of the present disclosure. For example, the infrastructureobjects include a data store object 174 with associated data storepolicies 174A and counters 174B. The data store object 174 is used totrack a plurality of virtual disks (VMDKs) that may be used within a VMfor storing information.

The infrastructure objects include a storage device object 176 withstorage device policies 176A and counters 176B. The storage deviceobject 176 is used for tracking attributes of different storage devicesusing counters 176B.

A hypervisor (or VMM) object 178 with policies 178A and counters 178B isused for tracking attributes of the hypervisor using counters 178B. Avolume object 180 with policies 180A and counters 180B is used fortracking attributes of a volume using counters 180B. The volume object180 represents a volume that is presented to a host system for storingdata.

A storage node object 182 with policies 182A and counters 182B is usedfor tracking attributes of a storage node using counters 182B, forexample node CPU utilization, cache hit ratio, cache utilization,available capacity of a storage node for handling a new workload, andother attributes.

A storage array object 184 with policies 184A and counters 184B is usedfor tracking attributes of a storage array using counters 184B includingused capacity at any given time, available capacity, and otherattributes.

A storage pool object 186A with policies 186A and counters 186B is usedfor tracking attributes of a storage pool (for example, an aggregatehaving a plurality of storage devices) using counters 186B.

A virtual machine (or VM) object 190 with policies 190A and counters190B is used for tracking attributes of a VM using counters 190B. Avirtual disk object (VMDK) 188 with policies 188A and counters 188B isused for tracking attributes of a VMDK using counters 188B.

An internal volume object 193 with policies 193A and counters 193B isused for tracking attributes of an internal volume using counters 193B.An internal volume is a logical representation of storage as maintainedby a storage operating system, described below in detail.

A port object 195 with associated policies 195A and counters 195B isused to track port attributes.

A host system object 197 with associated policies 197A and counters 197Bis used to represent host computing systems, for example, 104.

A NAS performance object 199 is used to track performance of a hostassociated with an internal volume using policies 199A. Performancecounters 199B track the total number of operations for the internalvolume from the specific host based on data from RAU 101. Details ofusing the NAS performance object 199 are provided below.

Table I below shows an example of various counters/metrics associatedwith various objects (for example, Storage (e.g., 176, FIG. 1H), StorageNode (e.g., 182, FIG. 1H), and Storage Pool (e.g., 186, FIG. 1H)) ofFIG. 1H that are maintained by the management system 118 to implementthe storage monitoring layer 116H, according to one aspect of thepresent disclosure. The column labelled “Object” identifies aninfrastructure object that is monitored and tracked. The second columnshows the “Counter” (or metric) associated with the infrastructureobject. The third column shows the unit associated with the performancemetric. For example, the unit MBps (or MBS) means, megabytes per second,IOPS means number of I/Os (i.e., read and/or write) operations persecond, and the other units are self-explanatory. The fourth columnprovides a description of the performance data that is being collectedfor an object/counter.

Briefly, the “Storage” object of Table I is the storage device wheredata will be stored for a new workload, the object “Storage Node” is acompute node for an array/cluster that manages data flow to storagedevices and the object “Storage Pool” is a logical pool of storagedevices in a storage array that comprises of various storage nodes andstorage devices. The term port in Table I below may include aninter-connect switch port i.e., a storage switch port (different fromthe network switch 120 ports) that routes traffic between storage nodesas well as the adapter ports used by the storage nodes. It is noteworthythat Table I is only an example, other objects of FIG. 1F are alsotracked and can be used for implementing the adaptive aspects of thepresent disclosure.

TABLE I Object Counter(s)/Metrics Unit Description Storage AverageThroughput MBps Average amount of data read or written to the object inmegabytes per second in a sampling period Storage Total OperationsOperation Total number of Count operations observed in a sampling periodStorage Node Average Throughput MBps Average amount of data read orwritten to the object in megabytes per second in a sampling periodStorage Node Total Operations Operation Total number of Count operationsobserved in a sampling period Storage Node Resource PercentageUtilization of, for Utilization example, storage capacity, CPU, memoryor others in a sampling period Storage Node Total Port Errors None Thenumber of port errors in the array Storage Pool Capacity PercentageStorage device Utilization capacity utilization for the object in asampling period Storage Pool Total Operations Operation Total number ofCount operations observed in a sampling period Storage Pool AverageThroughput MBps Average amount of data read or written to the object inmegabytes per second in a sampling period

Process Flow: FIG. 1I shows a process 117 for mirroring network switchtraffic (e.g., NFS traffic), according to one aspect of the presentdisclosure. The process begins in block B119, when server systems 104,management system 118, RAU 101 and storage system 108 are initializedand operational. Application 106 at different servers or differentinstances of application 106 send read/write requests for reading andwriting data to and from the storage devices 110. Switch 120 isconfigured to mirror all the switch traffic using port 125 to RAU 101.It is noteworthy that more than one port can be used to mirror thenetwork switch traffic and more than one network switch may have itsmirror ports monitored by one (or more) RAU instances.

In block B121, at any given time, all incoming network traffic to ports122A-122N is mirrored by port 125 and sent to RAU 101 as networkpackets. In one aspect, as an example, where NFS is used to send I/Orequests, all NFS network traffic is mirrored. As an example, the NFSnetwork traffic may include the following fields: A network protocollayer version number (e.g., Internet Protocol version 4), a sourcenetwork address (e.g., client or server 104 IP address), and adestination network address (e.g., a target storage system IP address).A transport layer indicator (for example, TCP), a source TCP portnumber, a destination TCP port number, a sequence number for the TCPpacket, and a length of the TCP packet. An RPC PDU with indicatorindicating a RPC type, an RPC version (e.g., 2) program name (e.g.,NFS), a program version (e.g., NFS version) a transaction identifier(XID) and a procedure type (e.g., access). An NFS PDU that includes aprogram version, operation type, an object length, and a file handle.The network traffic is provided to the network interface 101A andtemporarily stored at one or more memory buffers (not shown).

In block B123, the packet reader 101B reads the network packets fromnetwork interface 101A. The network packets are provided to the packetre-assembler 101C that assembles the TCP segments included in Ethernetframes.

In block B125, the packet parser 101D extracts the RPC PDUs that areembedded in the reassembled TCP stream. The NFS PDUs are then extractedfrom the RPC PDUs.

In block B127, the packet parser 101D examines the NFS PDU to extractthe operation type information, and the encoded destination volumeidentifier and file location. The client IP address and target IPaddress are also obtained from the IP header. This information is thenprovided to the packet analyzer 101E.

In block B129, the packet analyzer 101E identifies a list of volumesthat are targets for the greatest number of operations. The packetanalyzer 101E also identifies a list of client IP addresses thatcontribute the most to the number of operations for the target volumes.The information (i.e. total number of operations, list of over-impactedvolumes (or hot volumes), client IP addresses and target storage systemIP addresses) is formatted and in block B131, the information is sent tothe management system 118 via the management switch interface 101F.

FIG. 1J shows a process 133 executed by the innovative computingtechnology of management system 118, according to one aspect of thepresent disclosure. The process begins in block B135, when the RAU 101has provided the total number of I/O operations (or NFS operations) thathave been executed within a certain time frame, a list of volumes thathave witnessed the greatest number of volumes (i.e., hot volumes) with alist of target storage system IP addresses and a list of client IPaddresses that have contributed to the list of over-impacted volumes.The management system 118 has also obtained storage performance andconfiguration data by executing the storage monitoring layer 116F aswell as host system/VM data by executing the server monitoring layer116H.

In block B137, the management system 118 pre-processes the data receivedfrom RAU 101. In one aspect, the management system loads raw sample datafrom RAU 101 into a memory of the management system 118. The managementsystem 118 scans each report from RAU 101 and merges the report toaccount for target storage system IP addresses, volumes and client IPaddresses that appear in multiple reports received from RAU 101.

In block B139, the management system 118 retrieves storage resource andserver data corresponding to the target storage system IP addresses,client IP addresses and the storage volume identifiers.

In block B141, the volume identifiers from RAU 101 are translated tointernal volume identifiers used by the storage system 108. Themanagement system 118 also generates an object (NAS performance object199, FIG. 1H) that describes a relationship between a host system andinternal volume with associated performance metrics (e.g., total numberof operations), described above.

Based on the translation, the management system 118 reports the data toa client. In one aspect, GUI 136 (FIG. 1D) presents an interface foreach host system and VM. The GUI displays the internal volumes andstorage associated with the host/VM with the “observed IOPS” for a timerange. The result may be displayed in a table or as an inline, stackedgraph. The GUI 136 may also present a landing page for each internalvolume with the host/VMs that are active for the internal volume. Theinterface also provides observed IOPS for the internal volume at theinternal volume landing page.

The presented data enables a user to optimize the use of storageresources by load balancing, adding more storage, adding more volumes,and other corrective action.

It is noteworthy that although the examples above are described withrespect to NFS, the innovative computing technology described herein canbe used with CIFS, SMB, iSCSI, and other protocols.

In one aspect, methods and systems for networked storage systems areprovided. One method includes receiving a plurality of requests from aplurality of client systems at a plurality of ports of a network switch(120, FIG. 1A) for reading and writing data in a networked storagesystem where a plurality of storage devices are accessed by theplurality of client systems via the plurality of ports of the networkswitch. Each request includes a transport layer packet (e.g., TCP), asource network access address (e.g., IP address) used by each clientsystem to send each request, a target network access address (e.g., IPaddress) for a storage system managing one or more storage devices, anapplication layer protocol data unit (e.g., a RPC PDU) that encapsulatesa file system request (e.g., a NFS PDU) with encoded information for astorage volume and an indicator indicating an operation type for eachrequest.

The method further includes mirroring the plurality of requests andtransmitting the mirrored plurality of requests by a dedicated mirrorport of the network switch to a remote acquisition unit; assembling bythe remote acquisition unit transport layer packets from the mirroredplurality of requests; extracting by the remote acquisition unitapplication layer protocol data units from the assembled transport layerpackets; parsing by the remote acquisition unit of the application layerprotocol data units to obtain file system requests; identifying by theremote acquisition unit storage volume identifiers from the parsed filesystem requests that are associated with a greatest number ofoperations; identifying network access addresses for client systemsinitiating the greatest number of operations for the storage volumes andnetwork access addresses of target storage systems managing the storagevolumes; and providing a total number of operations for the plurality ofrequests in a given time, the identified storage volume identifiers, thenetwork access addresses of the client systems and the network accessaddresses of the target storage systems to a management console.

The technology disclosed herein improves computing techniques that areused in data centers and networked storage environments. Individualagents at host systems are not required, instead, mirrored networktraffic is used to highlight volume-level performance with respect tothe host systems that use the volumes. This enables a storageadministrator to more efficiently use storage devices and otherresources of the network storage environment.

Clustered Storage System: FIG. 2A depicts an illustrative aspect of anetworked storage environment 200 with RAU 101 and management system118, described above in detail. The networked storage environmentincludes a plurality of server systems 204.1-204.2 (similar to serversystems 104 described above), RAU 101, network switch 120, a clusteredstorage system 202 (similar to storage system 108) and at least onecomputer network 206 communicably connecting the server systems204.1-204.2 and the clustered storage system 202. RAU 101 providesmirrored network switch 120 traffic to the management system 120. Themanagement system 118 retrieves and analyzes information from variouscluster nodes as described above in detail. In particular, storageperformance data 150 and configuration data 148 may be obtained from thevarious cluster nodes.

As shown in FIG. 2A, the clustered storage system 202 includes aplurality of nodes 208.1-208.3, a cluster switching fabric 210, and aplurality of mass storage devices 212.1-212.3 (similar to 110, FIG. 1A).

Each of the plurality of nodes 208.1-208.3 are configured to include anetwork module, a storage module (for example, Storage Node of Table I),and a management module, each of which can be implemented as a separateprocessor executable or machine implemented module. Specifically, node208.1 includes a network module 214.1, a storage module 216.1, and amanagement module 218.1, node 208.2 includes a network module 214.2, astorage module 216.2, and a management module 218.2, and node 208.3includes a network module 214.3, a storage module 216.3, and amanagement module 218.3.

The network modules 214.1-214.3 include functionality that enables therespective nodes 208.1-208.3 to connect to one or more of the clientsystems 204.1-204.2 over the computer network 206 (similar to network153, FIG. 1A), while the storage modules 216.1-216.3 connect to one ormore of the storage devices 212.1-212.3.

The management modules 218.1-218.3 provide management functions withinthe clustered storage system 202. Accordingly, each of the plurality ofserver nodes 208.1-208.3 in the clustered storage server arrangementprovides the functionality of a storage server.

A switched virtualization layer including a plurality of virtualinterfaces (VIFs) 220 is provided below the interface between therespective network modules 214.1-214.3 and the client systems204.1-204.2, allowing storage 212.1-212.3 associated with the nodes208.1-208.3 to be presented to the client systems 204.1-204.2 as asingle shared storage pool. For example, the switched virtualizationlayer may implement a virtual interface architecture. FIG. 2A depictsonly the VIFs 220 at the interfaces to the network modules 214.1, 214.3for clarity of illustration.

The clustered storage system 202 can be organized into any suitablenumber of virtual servers (VServers or storage virtual machines (SVMs))222A-222N, in which each virtual storage system represents a singlestorage system namespace with separate network access. Each virtualstorage system has a user domain and a security domain that are separatefrom the user and security domains of other virtual storage systems.Server systems 204 can access storage space via a VServer from any nodeof the clustered system 202.

Each of the nodes 208.1-208.3 may be defined as a computer adapted toprovide application services to one or more of the client systems204.1-204.2. In this context, a SVM is an instance of an applicationservice provided to a client system. The nodes 208.1-208.3 areinterconnected by the switching fabric 210, which, for example, may beembodied as a Gigabit Ethernet switch or any other network switch type.

Although FIG. 2A depicts three network modules 214.1-214.3, the storagemodules 216.1-216.3, and the management modules 218.1-218.3, any othersuitable number of network modules, storage modules, and managementmodules may be provided. There may also be different numbers of networkmodules, storage modules, and/or management modules within the clusteredstorage system 202. For example, in alternative aspects, the clusteredstorage system 202 may include a plurality of network modules and aplurality of storage modules interconnected in a configuration that doesnot reflect a one-to-one correspondence between the network modules andstorage modules.

The server systems 204.1-204.2 (similar to host 104) of FIG. 2A may beimplemented as computing devices configured to interact with therespective nodes 208.1-208.3 in accordance with a client/server model ofinformation delivery. In the presently disclosed aspect, the interactionbetween the server systems 204.1-204.2 and the nodes 208.1-208.3 enablethe provision of network data storage services. Specifically, eachserver system 204.1, 204.2 may request the services of one of therespective nodes 208.1, 208.2, 208.3, and that node may return theresults of the services requested by the client system by exchangingpackets over the computer network 206, which may be wire-based, opticalfiber, wireless, or any other suitable combination thereof. The serversystems 204.1-204.2 may issue packets according to file-based accessprotocols, such as the NFS or CIFS protocol, when accessing informationin the form of files and directories.

In a typical mode of operation, one of the server systems 204.1-204.2transmits an NFS or CIFS request for data to one of the nodes208.1-208.3 within the clustered storage system 202, and the VIF 220associated with the respective node receives the client request. It isnoted that each VIF 220 within the clustered system 202 is a networkendpoint having an associated IP address (i.e., the target storagesystem IP address). The server request typically includes a file handlefor a data file stored in a specified volume on at storage 212.1-212.3.The RAU 101 obtains the IP address and the volume identifier from thefile handle, as described above in detail.

Storage System Node: FIG. 2B is a block diagram of a computing system224, according to one aspect. System 224 may be used by a stand-alonestorage system 108 and/or a storage system node operating within acluster based storage system described above with respect to FIG. 2A.

System 224 may include a plurality of processors 226A and 226B, a memory228, a network adapter 234, a cluster access adapter 238 (used for acluster environment), a storage adapter 240, and local storage 236interconnected by a system bus 232. The local storage 236 comprises oneor more storage devices, such as disks, utilized by the processors tolocally store configuration and other information.

The cluster access adapter 238 comprises a plurality of ports adapted tocouple system 224 to other nodes of a cluster as described above withrespect to FIG. 2A. In the illustrative aspect, Ethernet may be used asthe clustering protocol and interconnect media, although it will beapparent to those skilled in the art that other types of protocols andinterconnects may be utilized within the cluster architecture describedherein.

System 224 is illustratively embodied as a dual processor storage systemexecuting a storage operating system 230 that preferably implements ahigh-level module, such as a file system, to logically organizeinformation as a hierarchical structure of named directories, files andspecial types of files called virtual disks (hereinafter generally“blocks”) on storage devices 110/212. However, it will be apparent tothose of ordinary skill in the art that the system 224 may alternativelycomprise a single or more than two processor systems. Illustratively,one processor 226 executes the functions of a network module on a node,while the other processor 226B executes the functions of a storagemodule.

The memory 228 illustratively comprises storage locations that areaddressable by the processors and adapters for storing programmableinstructions and data structures. The processor and adapters may, inturn, comprise processing elements and/or logic circuitry configured toexecute the programmable instructions and manipulate the datastructures. It will be apparent to those skilled in the art that otherprocessing and memory means, including various computer readable media,may be used for storing and executing program instructions describedherein. Memory 228 may also be used as a cache for processing I/Orequests.

The storage operating system 230, portions of which are typicallyresident in memory and executed by the processing elements, functionallyorganizes the system 224 by, inter alia, invoking storage operations insupport of the storage service provided by storage system 108. Anexample of operating system 230 is DATA ONTAP® (Registered trademark ofNetApp, Inc. operating system available from NetApp, Inc. thatimplements a Write Anywhere File Layout (WAFL® (Registered trademark ofNetApp, Inc.)) file system. However, it is expressly contemplated thatany appropriate storage operating system may be enhanced for use inaccordance with the inventive principles described herein. As such,where the term “ONTAP” is employed, it should be taken broadly to referto any storage operating system that is otherwise adaptable to theteachings of this invention.

The network adapter 234 comprises a plurality of ports adapted to couplethe system 224 to one or more server systems 104 over point-to-pointlinks, wide area networks, virtual private networks implemented over apublic network (Internet) or a shared local area network using network153 and network switch 120. The network adapter 234 thus may comprisethe mechanical, electrical and signaling circuitry needed to connectstorage system 108 to the network. Illustratively, the computer networkmay be embodied as an Ethernet network or a FC network.

The storage adapter 240 cooperates with the storage operating system 230executing on the system 224 to access information requested by theserver systems 104 and management system 118 (FIG. 1A). The informationmay be stored on any type of attached array of writable storage devicemedia such as video tape, optical, DVD, magnetic tape, bubble memory,electronic random access memory, flash memory devices, micro-electromechanical and any other similar media adapted to store information,including data and parity information.

The storage adapter 240 comprises a plurality of ports havinginput/output (I/O) interface circuitry that couples to the disks over anI/O interconnect arrangement, such as a conventional high-performance,FC link topology with a storage switch (not shown). In another aspect,instead of using a separate network and storage adapter, a convergedadapter is used to process both network and storage traffic.

Operating System: FIG. 3 illustrates a generic example of operatingsystem 230 executed by storage system 108, according to one aspect ofthe present disclosure. Storage operating system 230 interfaces with themanagement system 118 and provides information for the various datastructures maintained by the management system 118, described above indetail.

As an example, operating system 230 may include several modules, or“layers”. These layers include a file system manager 303 that keepstrack of a directory structure (hierarchy) of the data stored in storagedevices and manages read/write operations, i.e., executes read/writeoperations on disks in response to server system 104 requests.

Operating system 230 may also include a protocol layer 303 and anassociated network access layer 305, to allow system 200 to communicateover a network with other systems, such as server system 104 andmanagement system 118. Protocol layer 303 may implement one or more ofvarious higher-level network protocols, such as NFS, CIFS, HypertextTransfer Protocol (HTTP), TCP/IP, and others.

Network access layer 305 may include one or more drivers, whichimplement one or more lower-level protocols to communicate over thenetwork, such as Ethernet. Interactions between server systems 104 andmass storage devices 110/212 are illustrated schematically as a path,which illustrates the flow of data through operating system 230.

The operating system 230 may also include a storage access layer 307 andan associated storage driver layer 309 to communicate with a storagedevice. The storage access layer 307 may implement a higher-level diskstorage protocol, such as RAID, while the storage driver layer 309 mayimplement a lower-level storage device access protocol, such as FC orSCSI.

It should be noted that the software “path” through the operating systemlayers described above needed to perform data storage access for aclient request may alternatively be implemented in hardware. That is, inan alternate aspect of the disclosure, the storage access request datapath may be implemented as logic circuitry embodied within a fieldprogrammable gate array (FPGA) or an ASIC. This type of hardwareimplementation increases the performance of the file service provided bystorage system 108.

As used herein, the term “storage operating system” generally refers tothe computer-executable code operable on a computer to perform a storagefunction that manages data access and may implement data accesssemantics of a general purpose operating system. The storage operatingsystem can also be implemented as a microkernel, an application programoperating over a general-purpose operating system, such as UNIX® orWindows XP®, or as a general-purpose operating system with configurablefunctionality, which is configured for storage applications as describedherein.

In addition, it will be understood to those skilled in the art that theinvention described herein may apply to any type of special-purpose(e.g., file server, filer or storage serving appliance) orgeneral-purpose computer, including a standalone computer or portionthereof, embodied as or including a storage system. Moreover, theteachings of this disclosure can be adapted to a variety of storagesystem architectures including, but not limited to, a network-attachedstorage environment, a storage area network, and a disk assemblydirectly-attached to a client or host computer. The term “storagesystem” should therefore be taken broadly to include such arrangementsin addition to any subsystems configured to perform a storage functionand associated with other equipment or systems.

Processing System: FIG. 4 is a high-level block diagram showing anexample of the architecture of a processing system, at a high level, inwhich executable instructions as described above can be implemented. Theprocessing system 400 can represent modules of RAU 101, managementsystem 118, user console 102, server systems 104, storage system 108,and others. Note that certain standard and well-known components whichare not germane to the present invention are not shown in FIG. 4.

The processing system 400 includes one or more processors 402 and memory404, coupled to a bus system 405. The bus system 405 shown in FIG. 4 isan abstraction that represents any one or more separate physical busesand/or point-to-point connections, connected by appropriate bridges,adapters and/or controllers. The bus system 405, therefore, may include,for example, a system bus, a Peripheral Component Interconnect (PCI)bus, a HyperTransport or industry standard architecture (ISA) bus, asmall computer system interface (SCSI) bus, a universal serial bus(USB), or an Institute of Electrical and Electronics Engineers (IEEE)standard 1394 bus (sometimes referred to as “Firewire”).

The processors 402 are the central processing units (CPUs) of theprocessing system 400 and, thus, control its overall operation. Incertain aspects, the processors 402 accomplish this by executingprogrammable instructions stored in memory 404. A processor 402 may be,or may include, one or more programmable general-purpose orspecial-purpose microprocessors, digital signal processors (DSPs),programmable controllers, application specific integrated circuits(ASICs), programmable logic devices (PLDs), or the like, or acombination of such devices.

Memory 404 represents any form of random access memory (RAM), read-onlymemory (ROM), flash memory, or the like, or a combination of suchdevices. Memory 404 includes the main memory of the processing system400. Instructions 406 which implements techniques introduced above mayreside in and may be executed (by processors 402) from memory 404. Forexample, instructions 406 may include code for Packet Analysis Service101G, performance module 140, acquisition module 144, configurationmodule 142, GUI 136 as well as instructions for executing the processblocks of FIGS. 1I/1J.

Also connected to the processors 402 through the bus system 405 are oneor more internal mass storage devices 410, and a network adapter 412.Internal mass storage devices 410 may be or may include any conventionalmedium for storing large volumes of data in a non-volatile manner, suchas one or more magnetic or optical based disks. The network adapter 412(for example, network interface 101A, FIG. 1C) provides the processingsystem 400 with the ability to communicate with remote devices (e.g.,storage servers) over a network and may be, for example, an Ethernetadapter, a FC adapter, or the like. The processing system 400 alsoincludes one or more input/output (I/O) devices 408 coupled to the bussystem 405. The I/O devices 408 may include, for example, a displaydevice, a keyboard, a mouse, etc.

Cloud Computing: The system and techniques described above areapplicable and useful in the cloud computing environment. Cloudcomputing means computing capability that provides an abstractionbetween the computing resource and its underlying technical architecture(e.g., servers, storage, networks), enabling convenient, on-demandnetwork access to a shared pool of configurable computing resources thatcan be rapidly provisioned and released with minimal management effortor service provider interaction. The term “cloud” is intended to referto the Internet and cloud computing allows shared resources, forexample, software and information to be available, on-demand, like apublic utility.

Typical cloud computing providers deliver common business applicationsover the Internet online which are accessed from another service orsoftware like a web browser, while the software and data are storedremotely on servers. The cloud computing architecture uses a layeredapproach for providing application services. A first layer is anapplication layer that is executed at client computers. In this example,the application allows a client to access storage via a cloud.

After the application layer, is a cloud platform and cloudinfrastructure, followed by a “server” layer that includes hardware andcomputer software designed for cloud specific services. The managementsystem 118 (and associated methods thereof) and storage systemsdescribed above can be a part of the server layer for providing storageservices. Details regarding these layers are not germane to theinventive aspects.

Thus, a method and apparatus for managing resources within system 100have been described. Note that references throughout this specificationto “one aspect” or “an aspect” mean that a particular feature, structureor characteristic described in connection with the aspect is included inat least one aspect of the present invention. Therefore, it isemphasized and should be appreciated that two or more references to “anaspect” or “one aspect” or “an alternative aspect” in various portionsof this specification are not necessarily all referring to the sameaspect. Furthermore, the particular features, structures orcharacteristics being referred to may be combined as suitable in one ormore aspects of the present disclosure, as will be recognized by thoseof ordinary skill in the art.

While the present disclosure is described above with respect to what iscurrently considered its preferred aspects, it is to be understood thatthe disclosure is not limited to that described above. To the contrary,the disclosure is intended to cover various modifications and equivalentarrangements within the spirit and scope of the appended claims.

What is claimed is:
 1. A machine implemented method, comprising:receiving a plurality of requests from a plurality of client systems ata plurality of ports of a network switch for reading and writing data ina networked storage system where a plurality of storage devices areaccessed by the plurality of client systems via the plurality of portsof the network switch; wherein each request includes a transport layerpacket, a source network access address used by each client system tosend each request, a target network access address for a storage systemmanaging one or more storage devices, an application layer protocol dataunit that encapsulates a file system request with encoded informationfor a storage volume and an indicator indicating an operation type foreach request; mirroring the plurality of requests and transmitting themirrored plurality of requests by a dedicated mirror port of the networkswitch to a remote acquisition unit; assembling, by the remoteacquisition unit, transport layer packets from the mirrored plurality ofrequests; extracting, by the remote acquisition unit, application layerprotocol data units from the assembled transport layer packets; parsing,by the remote acquisition unit, the application layer protocol dataunits to obtain file system requests; identifying, by the remoteacquisition unit, storage volume identifiers from the parsed file systemrequests that are associated with a greatest number of operations;identifying, by the remote acquisition unit, network access addressesfor client systems initiating the greatest number of operations for thestorage volumes and network access addresses of target storage systemsmanaging the storage volumes; and providing, by the remote acquisitionunit, a total number of operations for the plurality of requests in agiven time, the identified storage volume identifiers, the networkaccess addresses of the client systems and the network access addressesof the target storage systems to a management console.
 2. The method ofclaim 1, further comprising: executing a storage monitoring layer by themanagement console for tracking performance of storage resources of thenetworked storage system; and executing a server monitoring layer by themanagement console for tracking computing resources using the storageresources of the networked storage system.
 3. The method of claim 2,wherein the management console translates the identified storage volumeidentifiers received from the remote acquisition unit to internalstorage volume identifiers tracked by the storage monitoring layer. 4.The method of claim 2, wherein based on data from the storage monitoringlayer, the server monitoring layer, the identified storage volumesidentifiers, the network access addresses of the client systems, and thenetwork access addresses of the target storage systems, the managementconsole creates an object that associates a compute resource with aninternal volume for tracking performance of resources associated withthe internal volume for storing and retrieving data.
 5. The method ofclaim 1, wherein the file system requests are network file system (NFS)requests.
 6. The method of claim 2, wherein the plurality of resourcesincludes a storage pool having the plurality of storage devices.
 7. Themethod of claim 1, wherein the transport layer packets are TCP packets,the application layer protocol data unit is a remote procedure call(RPC) protocol data unit and network access addresses for the clientsystems and the target storage systems are Internet Protocol (IP)addresses.
 8. A non-transitory machine-readable storage medium havingstored thereon instructions for performing a method, comprising machineexecutable code, which when executed by at least one machine, causes themachine to: receive a plurality of requests from a plurality of clientsystems at a plurality of ports of a network switch for reading andwriting data in a networked storage system where a plurality of storagedevices are accessed by the plurality of client systems via theplurality of ports of the network switch; wherein each request includesa transport layer packet, a source network access address used by eachclient system to send each request, a target network access address fora storage system managing one or more storage devices, an applicationlayer protocol data unit that encapsulates a file system request withencoded information for a storage volume and an indicator indicating anoperation type for each request; mirror the plurality of requests andtransmitting the mirrored plurality of requests by a dedicated mirrorport of the network switch to a remote acquisition unit; assemble, bythe remote acquisition unit, transport layer packets from the mirroredplurality of requests; extract, by the remote acquisition unit,application layer protocol data units from the assembled transport layerpackets; parse, by the remote acquisition unit, the application layerprotocol data units to obtain file system requests; identify, by theremote acquisition unit, storage volume identifiers from the parsed filesystem requests that are associated with a greatest number ofoperations; identify, by the remote acquisition unit, network accessaddresses for client systems initiating the greatest number ofoperations for the storage volumes and network access addresses oftarget storage systems managing the storage volumes; and provide, by theremote acquisition unit, a total number of operations for the pluralityof requests in a given time, the identified storage volume identifiers,the network access addresses of the client systems, and the networkaccess addresses of the target storage systems to a management console.9. The non-transitory storage medium of claim 8, wherein the managementconsole executes a storage monitoring layer for tracking performance ofstorage resources of the networked storage system; and executes a servermonitoring layer for tracking computing resources using the storageresources of the networked storage system.
 10. The non-transitorystorage medium of claim 9, wherein the management console translates theidentified storage volume identifiers received from the remoteacquisition unit to internal storage volume identifiers tracked by thestorage monitoring layer.
 11. The non-transitory storage medium of claim9, wherein based on data from the storage monitoring layer, the servermonitoring layer, the identified storage volumes identifiers, thenetwork access addresses of the client systems, and the network accessaddresses of the target storage systems, the management console createsan object that associates a compute resource with an internal volume fortracking performance of resources associated with the internal volumefor storing and retrieving data.
 12. The non-transitory storage mediumof claim 8, wherein the file system requests are network file system(NFS) requests.
 13. The non-transitory storage medium of claim 9,wherein the plurality of resources includes a storage pool having theplurality of storage devices.
 14. The non-transitory storage medium ofclaim 8, wherein the transport layer packets are TCP packets, theapplication layer protocol data unit is a remote procedure call (RPC)protocol data unit and network access addresses for the client systemsand the target storage systems are Internet Protocol (IP) addresses. 15.A system, comprising: a network switch having a plurality of ports; anda remote acquisition unit coupled to a management console and a mirrorport of the network switch, the remote acquisition unit having a memorycontaining machine readable medium comprising machine executable codehaving stored thereon instructions; and a processor module coupled tothe memory: wherein the network switch receives a plurality of requestsfrom a plurality of client systems at a plurality of ports for readingand writing data in a networked storage system where a plurality ofstorage devices are accessed by the plurality of client systems via theplurality of ports; wherein each request includes a transport layerpacket, a source network access address used by each client system, atarget network access for a storage system managing one or more storagedevices, an application layer protocol data unit that encapsulates afile system request with encoded information for a storage volume and anindicator indicating an operation type for each request; and wherein theplurality of requests are mirrored and transmitted by the mirror port ofthe network switch to the remote acquisition unit; and wherein theprocessor module of the remote acquisition unit is configured to executethe machine executable code to: assemble the transport layer packetsfrom the mirrored plurality of requests; extract the application layerprotocol data units from the assembled transport layer packets; parsethe application layer protocol data units to obtain file systemrequests; identify the storage volume identifiers from the parsed filesystem requests that are associated with a greatest number ofoperations; identify network access addresses for client systemsinitiating the greatest number of operations for the storage volumes andnetwork access addresses of target storage systems managing the storagevolumes; and provide a total number of operations for the plurality ofrequests in a given time, the identified storage volume identifiers, thenetwork access addresses of the client systems, and the network accessaddresses of the target storage systems to a management console.
 16. Thesystem of claim 15, wherein the management console executes a storagemonitoring layer for tracking performance of storage resources of thenetworked storage system; and executes a server monitoring layer fortracking computing resources using the storage resources of thenetworked storage system.
 17. The system of claim 16, wherein themanagement console translates the identified storage volume identifiersreceived from the remote acquisition unit to internal storage volumeidentifiers tracked by the storage monitoring layer.
 18. The system ofclaim 16, wherein based on data from the storage monitoring layer, theserver monitoring layer, the identified storage volumes identifiers, thenetwork access addresses of the client systems, and the network accessaddresses of the target storage systems, the management console createsan object that associates a compute resource with an internal volume fortracking performance of resources associated with the internal volumefor storing and retrieving data.
 19. The system of claim 16, wherein theplurality of resources includes a storage pool having the plurality ofstorage devices.
 20. The system of claim 15, wherein the file systemrequests are network file system (NFS) requests, the transport layerpackets are TCP packets, the application layer protocol data unit is aremote procedure call (RPC) protocol data unit, and network accessaddresses for the client systems and the target storage systems areInternet Protocol (IP) addresses.